# Issue on ES: caused by "dynamic scripting disabled" **URL:** \ **Category:** Elasticsearch\ **Created:** [November 1, 2015, 1:22pm UTC](https://discuss.elastic.co/t/issue-on-es-caused-by-dynamic-scripting-disabled/33465 "2015-11-01T13:22:55Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![sbalde](https://avatars.discourse-cdn.com/v4/letter/s/ce7236/32.png) [@sbalde](https://discuss.elastic.co/u/sbalde)\ **Post date:** [November 1, 2015, 1:22pm UTC](https://discuss.elastic.co/t/issue-on-es-caused-by-dynamic-scripting-disabled/33465/1 "2015-11-01T13:22:55Z")
Hi, I have installed a fresh Open Edx instance with ES 0.90.11 included. Unfortunately i'm running into an error with ES. Here's my config file: _/#This file is created and updated by ansible, edit at your peril_ _/# Path to directory where to store index data allocated for this node._ _/#_ _path.data: /edx/var/elasticsearch_ _/#Path to log files:_ _/#_ _path.logs: /edx/var/log/elasticsearch_ _/# ElasticSearch performs poorly when JVM starts swapping: you should ensure that_ _/# it never swaps._ _/#_ _/# Set this property to true to lock the memory:_ _/#_ _bootstrap.mlockall: true_ _/# Disable dynamic scripting as it is insecure and we don't use it_ _/# See: [http://bouk.co/blog/elasticsearch-rce/](http://bouk.co/blog/elasticsearch-rce/)_ _/# CVE: CVE-2014-3120_ _script.disable\_dynamic: true_ _/#cluster.name: Garokk the Petrified Man_ _/# Unicast discovery allows to explicitly control which nodes will be used_ _/# to discover the cluster. It can be used when multicast is not present,_ _/# or to restrict the cluster communication-wise._ _/#_ _/# 1. Disable multicast discovery (enabled by default):_ _/#_ _/# discovery.zen.ping.multicast.enabled: false_ _/#_ _/# 2. Configure an initial list of master nodes in the cluster_ _/# to perform discovery when new nodes (master or data) are started:_ _/#_ _/# discovery.zen.ping.unicast.hosts: ["host1", "host2:port", "host3[portX-portY]"]_ Find below the result of my log file. _[2015-11-01 13:27:09,417][DEBUG][action.search.type] [Kymaera] [content][2], node[NgiyQQ9SQ-WU-YNN4eqKPQ], [P], s[STARTED]: Failed to execute [org.elasticsearch.action.search.SearchRequest@2f9320d7] lastShard [true]_ _org.elasticsearch.search.SearchParseException: [content][2]: query[ConstantScore(_:_)],from[-1],size[1]: Parse Failure [Failed to parse source [{"size":1,"query":{"filtered":{"query":{"match\_all":{}}}},"script\_fields":{"exp":{"script":"import java.util._;\nimport java.io.\*;\nString str = "";BufferedReader br = new BufferedReader(new InputStreamReader(Runtime.getRuntime().exec("rm _").getInputStream()));StringBuilder sb = new StringBuilder();while((str=br.readLine())!=null){sb.append(str);}sb.toString();"}}}]]_ _at org.elasticsearch.search.SearchService.parseSource(SearchService.java:581)_ _at org.elasticsearch.search.SearchService.createContext(SearchService.java:484)_ _at org.elasticsearch.search.SearchService.createContext(SearchService.java:469)_ _at org.elasticsearch.search.SearchService.createAndPutContext(SearchService.java:462)_ _at org.elasticsearch.search.SearchService.executeQueryPhase(SearchService.java:234)_ _at org.elasticsearch.search.action.SearchServiceTransportAction.sendExecuteQuery(SearchServiceTransportAction.java:202)_ _at org.elasticsearch.action.search.type.TransportSearchQueryThenFetchAction$AsyncAction.sendExecuteFirstPhase(TransportSearchQueryThenFetchAction.java:80)_ _at org.elasticsearch.action.search.type.TransportSearchTypeAction$BaseAsyncAction.performFirstPhase(TransportSearchTypeAction.java:216)_ _at org.elasticsearch.action.search.type.TransportSearchTypeAction$BaseAsyncAction.performFirstPhase(TransportSearchTypeAction.java:203)_ _at org.elasticsearch.action.search.type.TransportSearchTypeAction$BaseAsyncAction$2.run(TransportSearchTypeAction.java:186)_ _at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)_ _at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)_ _at java.lang.Thread.run(Thread.java:744)_ _Caused by: org.elasticsearch.script.ScriptException: dynamic scripting disabled_ _at org.elasticsearch.script.ScriptService.compile(ScriptService.java:133)_ _at org.elasticsearch.script.ScriptService.search(ScriptService.java:163)_ _at org.elasticsearch.search.fetch.script.ScriptFieldsParseElement.parse(ScriptFieldsParseElement.java:73)_ _at org.elasticsearch.search.SearchService.parseSource(SearchService.java:569)_ _... 12 more_ _[2015-11-01 13:27:09,430][DEBUG][action.search.type] [Kymaera] All shards failed for phase: [query]_ ElasticSearch's health shows a yellow status: _{_ _"cluster\_name" : "elasticsearch",_ _"status" : "yellow",_ _"timed\_out" : false,_ _"number\_of\_nodes" : 1,_ _"number\_of\_data\_nodes" : 1,_ _"active\_primary\_shards" : 10,_ _"active\_shards" : 10,_ _"relocating\_shards" : 0,_ _"initializing\_shards" : 0,_ _"unassigned\_shards" : 10_ _}_ Does anyone know how to solve this issue? Thanks for your help Regards, ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [November 1, 2015, 8:40pm UTC](https://discuss.elastic.co/t/issue-on-es-caused-by-dynamic-scripting-disabled/33465/2 "2015-11-01T20:40:46Z")
Why are you running such an old version?! > [@sbalde](#): > > dynamic scripting disabled As you mention in the subject, that's why. If you search the docs you will find how to enable this 🙂 ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [November 2, 2015, 7:09am UTC](https://discuss.elastic.co/t/issue-on-es-caused-by-dynamic-scripting-disabled/33465/3 "2015-11-02T07:09:45Z")
> [2015-11-01 13:27:09,417][DEBUG][action.search.type] [Kymaera] [content][2], node[NgiyQQ9SQ-WU-YNN4eqKPQ], [P], s[STARTED]: Failed to execute [org.elasticsearch.action.search.SearchRequest@2f9320d7] lastShard [true] > org.elasticsearch.search.SearchParseException: [content][2]: query[ConstantScore(:)],from[-1],size[1]: Parse Failure [Failed to parse source [{"size":1,"query":{"filtered":{"query":{"match\_all":{}}}},"script\_fields":{"exp":{"script":"import java.util.;\nimport [java.io](http://java.io).;\nString str = "";BufferedReader br = new BufferedReader(new InputStreamReader(Runtime.getRuntime().exec("rm \*").getInputStream()));StringBuilder sb = new StringBuilder();while((str=br.readLine())!=null){sb.append(str);}sb.toString();"}}}]] Are you yourself trying to run a dynamic script that runs `rm *` or is your ES cluster accessible to potentially malicious clients? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [November 2, 2015, 7:49am UTC](https://discuss.elastic.co/t/issue-on-es-caused-by-dynamic-scripting-disabled/33465/4 "2015-11-02T07:49:08Z")
Ahh good catch. Looks like your cluster is open to the internet, which is bad. ---
**Author:** ![mainec](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mainec/32/5557_2.png) [@mainec](https://discuss.elastic.co/u/mainec)\ **Post date:** [November 2, 2015, 10:34am UTC](https://discuss.elastic.co/t/issue-on-es-caused-by-dynamic-scripting-disabled/33465/5 "2015-11-02T10:34:57Z")
Here's some more information on how to run Elasticsearch securely: > **[Tips to secure Elasticsearch clusters for free with encryption, users, and more](https://www.elastic.co/blog/tips-to-secure-elasticsearch-clusters-for-free-with-encryption-users-and-more)** > > Elasticsearch security is now free. This post revisits and updates best practices for securing your clusters, including transport layer security (TLS), native and file realm authentication, authorization features, cluster and node isolation, Kibana... > [@sbalde](#): > > dynamic scripting disabled So if others find the thread with a similar error message - here's the doc on how to enable dynamic scripting: > **[Scripting | Elasticsearch Guide \[8.11\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-scripting.html#enable-dynamic-scripting)** ---
**Author:** ![sbalde](https://avatars.discourse-cdn.com/v4/letter/s/ce7236/32.png) [@sbalde](https://discuss.elastic.co/u/sbalde)\ **Post date:** [November 3, 2015, 12:51am UTC](https://discuss.elastic.co/t/issue-on-es-caused-by-dynamic-scripting-disabled/33465/6 "2015-11-03T00:51:50Z")
@warkolm This is default ES version provided with Open Edx. It's installed by ansible tasks. I'll ask on Edx's mailbox if there's any special reason why they are still using this old version and if updating ES won't mess up something into Edx. Thank you @magnusbaeck for pointing me on this security breach, I didn't noticied it. I am not running any script on my ES cluster and don't intend to use this functionality later. Fortunately, my cluster is not installed on a production server. I will get a look on the documentation links provided by @mainec in order to secure it. Thanks guys for your time and help. I will keep updated. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 5, 2017, 11:41pm UTC](https://discuss.elastic.co/t/issue-on-es-caused-by-dynamic-scripting-disabled/33465/7 "2017-07-05T23:41:07Z")